CVE-2024-9074 is a stored cross-site scripting vulnerability in the Advanced Blocks Pro WordPress plugin by essamamdani. It affects all versions up to and including 1.0.0. The vulnerability allows authenticated users with Author-level permissions or higher to upload SVG files containing malicious scripts due to inadequate sanitization and escaping of SVG input. When these SVG files are accessed by other users, the embedded scripts execute, potentially leading to client-side code execution. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the Author level, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with Author-level access can inject persistent malicious scripts via SVG uploads, which execute in the context of users viewing the SVG files. This can lead to unauthorized actions such as session hijacking or data manipulation affecting confidentiality and integrity. There is no direct impact on system availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level and higher users from uploading SVG files or disable SVG uploads entirely. Implement additional input validation and output escaping on SVG content if possible. Monitor vendor channels for updates and apply official patches once available.